Data Breach Response
GlobalB Law provides rapid, coordinated legal support when a personal data breach occurs, from initial assessment and mandatory regulatory notification through to authority engagement and litigation risk management.
A data breach is not a hypothetical risk, it is a near-certain operational event for any organisation that processes personal data at scale. The legal consequences of a breach depend less on the breach itself and more on how the organisation responds in the hours and days that follow. GDPR requires notification to the supervisory authority within 72 hours of becoming aware; KVKK imposes the same window. Getting that notification right, neither under-disclosing nor over-disclosing, is a legal judgment call that has material consequences for how the authority treats you in the subsequent investigation.
GlobalB Law operates as your external legal incident response team. We move quickly: assessing the breach within hours, advising on notification obligation and timing, drafting the authority notification, advising on whether affected individuals must be notified, and managing the investigation that typically follows. We also advise on the contractual notification obligations you likely have to processor customers, platform partners and insurers, obligations that run on different timelines and involve different legal standards than the regulatory requirements.
Beyond the immediate response, we help clients learn from the incident. Post-breach, we conduct targeted legal review of the gaps the incident revealed, in technical measures, vendor agreements, staff training or breach-detection procedures, and translate those findings into a remediation plan that demonstrates accountability to the authority and reduces recurrence risk.
What we do
Services in this practice
پرسشهای متداول
پرسشهای پرتکرار
We discovered a potential data breach this morning. What should we do right now?
Preserve evidence and do not delete logs. Convene your incident response team and document what is known and unknown. Contact your legal counsel immediately, the 72-hour notification clock under GDPR and KVKK starts running from the moment you become 'aware' of a breach, and that threshold can be reached before you have full information. Early legal involvement shapes how you manage both the documentation and the investigation in a way that protects your position.
Do we have to notify every affected user after a breach?
Not necessarily. Data subject notification is required under GDPR only when a breach is likely to result in a high risk to the rights and freedoms of individuals, a risk threshold that is higher than the authority notification threshold. Under KVKK, similar risk-based criteria apply. We advise on whether the breach characteristics trigger this obligation and how to communicate effectively and defensibly when they do.
What happens if we miss the 72-hour notification deadline?
Late notification is a sanctionable breach in itself under both GDPR and KVKK, and supervisory authorities routinely cite it in fine decisions. If you miss the deadline, you should still notify, late notification with an explanation is better than non-notification. The explanation needs to be substantive: 'we were still investigating' is only acceptable up to a point; at some stage the authority expects you to notify on the basis of what you know, and update the notification as more information becomes available.
We are a processor, our client suffered the breach, not us. What are our obligations?
Under GDPR, processors must notify the controller 'without undue delay' after becoming aware of a breach. Article 33(2). KVKK and processor agreements typically mirror this. Your contractual obligations to your controller may require notification even faster than the regulatory baseline, depending on your DPA terms. You should also assess whether you have direct authority notification obligations if you process data in your own right for any purpose. We advise processors on their distinct, and often underestimated, breach response obligations.
شروع کنید
وقت ملاقات بگیرید
موضوع خود را با ما در میان بگذارید تا شما را به وکیل مناسب وصل کنیم.